Anthropic Disrupting AI-Espionage
Hi, I’m Mike Broomfield, an experienced cybersecurity leader with around 20 years of hands-on experience spanning consultancies, global financial institutions, and large-scale enterprises. My career has taken me from penetration testing and security architecture roles at leading consultancies and major banks to my current position as Head of Application Security & Security Testing at Tesco. I have a deep passion for security research and engineering innovation, with a focus on embedding security seamlessly into modern software delivery. Over the years, I’ve led initiatives that integrate security into CI/CD pipelines, automate developer guardrails, and strengthen the resilience of complex, cloud-native systems. My approach blends a developer-first mindset with a curiosity for how systems fail and how they can be built stronger.
I’ve been saying for the last couple of years that the future of cybersecurity is attacker automation systems versus defender automation systems and we’re now watching that prediction materialise.
Last week, Anthropic blew open the lid on a troubling milestone: the first large-scale, AI-orchestrated espionage campaign detected and halted in the wild. The attackers (high-confidence linked to a China state-sponsored group) harnessed Claude Code and MCP (Model Context Protocol) agents across ~30 global targets, including tech, finance, government, and chemical sectors. Some intrusions succeeded, but the campaign’s most chilling detail: 80–90%+ of the attack was autonomous, with only a few critical decision points requiring human oversight.
You can read the full report here, below are my thoughts:
1. Laudable Transparency
Anthropic’s disclosure invites major applause. Their detailed breakdown reveals insights only LLM vendors can see, from prompts to automated tool chaining. This detail gives defenders a rare, real-world look into AI-enabled espionage.
2. Technical Specifics vs. Strategic Insights
Yes, the report lacks IOCs, exact prompts, or deep-forensic indicators, stuff traditionally demanded by the security community.
But it does offer attack architecture, automated agentic orchestration, and prompt-chaining methodology. This is arguably more valuable in this novel context. These shape proactive detection and system design thinking. MITRE ATT&CK mappings are needed—but the broader architectural visibility is the real breakthrough.
3. Beyond Jailbreaking
While jailbreaking often headlines AI attacks, the real threat is agentic orchestration at scale.
Here, attackers deliberately tricked Claude, not by exploiting an unknown bug, but by social engineering it into thinking the action was benign.
Defenders need signature and behaviour-based detection that goes beyond prompt restrictions, tracking automated abnormal task chains and lead-lag behaviours.
4. No Zero-Days needed
This campaign didn’t rely on fresh zero-day exploits; instead it magnified regular foundational techniques, scanning, credential harvesting and exfiltration with speed, coordination, and scale.
The alarming takeaway: AI supercharges everyday playbooks.
5. Trust Breaks Both Ways
Claude’s hallucinations slowed the attack, but here’s the nuance: hallucination is a smaller problem for attackers than defenders.
Why? Attackers can afford failures, they can retry, iterate, and improve without catastrophic consequences. Defenders, on the other hand, often operate in a zero-tolerance environment where a single miss can mean compromise.
This asymmetry makes resilience and detection far more critical than perfection.
6. Investing in Agentic Defenses & ATT&CK Integration
Anthropic has already expanded classifiers and detection capabilities. Meanwhile industry leaders highlight the urgency of “agentic SOCs”.
Defenders must architect agentic detection policies for MCP usage, prompt chaining, credential automation and map observed behaviours into MITRE TTP frameworks. CISA, MITRE, and Cyber Kill Chain integrations will make this practical.
Conclusions
This wasn’t hypothetical, it was China-based, state-sponsored, and successful. Targets included tech companies, financial institutions, and government agencies.
The attackers broke the campaign into hundreds of small, seemingly benign tasks, using jailbreaking techniques only for the hardest-to-disguise steps.
One striking detail: the system automatically wrote exploit code, which was then deployed and successfully exfiltrated data.
The only reason we have any visibility into this attack is because they used commercial models. What happens when China deploys custom models as good or better than today’s generation? At that point, detection and attribution become exponentially harder.
